Mixpanel smishing breach exposes OpenAI API user data
Mixpanel detected an SMS phishing campaign on November 8, 2025 that led to unauthorized access affecting a limited number of its customers; it revoked sessions, rotated credentials and reset all employee passwords. OpenAI disclosed in late November that a Mixpanel dataset with profile information for some platform.openai.com API users had been exported, and it ended its use of Mixpanel.
- Victim
- Mixpanel and some of its customers, including OpenAI
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Nov 8, 2025
- First disclosed
- Nov 26, 2025
- Actor
- Unattributed
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A text message was enough to compromise an analytics vendor holding customer profile data. Phishing-resistant MFA for vendor staff, and sending vendors only the data they need, limit the downstream exposure.
Sources
- Our response to a recent security incident, Mixpanel, Nov 27, 2025
- OpenAI admits data breach after analytics partner hit by phishing attack, CSO Online, Nov 27, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Workday CRM contact data taken in a social engineering campaign 2025 · Credential phishing
- Retool SMS phishing, deepfaked call and Google Authenticator cloud sync 2023 · Credential phishing
- Mailchimp internal support tool access via employee social engineering 2023 · Credential phishing
Cite this record
SWI Community Team. (2026). Mixpanel smishing breach exposes OpenAI API user data. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-mixpanel-smishing-openai-api-users/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.